Marin Ivezic
Consider the morning after a research group publishes a verified factorization of an RSA-2048 key on a quantum computer. RSA-2048 is the public-key algorithm protecting a large share of the banking sessions, software updates and certificate chains in use today. Nothing goes dark that morning. Payment terminals still authorise, email still opens, the browser padlock still appears. What ends is the assumption underneath all of it, and the questions start within hours, from the board, from the regulator, from the largest customer, from the insurer who wrote the cyber policy.
Q-Day is usually described as the day a quantum computer breaks RSA and elliptic-curve cryptography (ECC), the two algorithm families that carry most public-key security on the internet. A more useful working definition for a board is the day classical public-key cryptography loses the presumption of safety. Nobody has to be attacked for that to happen. Someone only has to prove it can be done.
Attack Economics and Trust Economics
The engineering objection to Q-Day panic is a fair one. Craig Gidney’s 2025 estimate puts the factoring of a single RSA-2048 key at fewer than one million noisy physical qubits running for under a week, revised down from the 20 million physical qubits and roughly eight hours in the 2019 Gidney-Ekerå estimate. Machines at that scale will be few, expensive to operate and booked solid. Their owners will point them at intelligence targets and strategic archives, not at a regional insurer’s customer portal. On attack economics, most organisations have years.
Trust economics run on a different schedule. The published result says nothing about your network and everything about the algorithm your network depends on, which means the presumption changes for every organisation on the same day. Buyers, regulators and counterparties respond to the published result, because that is the only information they have. A firm with excellent controls and a firm with none look identical from outside until one of them produces evidence.
Both statements are true at the same time, and the gap between them is the whole problem. The attack arrives slowly. The demand for proof arrives at once.
The First Week Is a Proof Exercise
What organisations experience in the days after a credible break is interrogation: every relationship that rested on an unexamined assumption about encryption becomes a request for documentation, and the requests arrive faster than most teams can answer them.
Banking and payments. Supervisors will ask what protects funds transfer authorisation and how quickly it can be replaced. Corporate treasurers will ask the same of their banks. A bank that can’t answer within a day or two doesn’t lose money on the fraud it suffered, it loses deposits to the competitor that published an answer on Tuesday.
Digital assets. Ownership on most public chains rests on ECC signatures, and any address whose public key has already appeared on-chain, through early pay-to-public-key outputs or through address reuse, is exposed the moment those signatures can be forged. Exchanges and custodians will be asked which holdings fall into that category. Markets will price the question long before anyone answers it.
Identity and software distribution. Certificate authorities sign the credentials that tell a browser a site is genuine, and software vendors sign the updates that machines install without asking. Both signatures become questionable at once. Enterprises will start refusing unsigned or legacy-signed updates, and patching slows down across the whole customer base while the industry re-issues keys.
Operational technology. Grid operators, pipeline operators and hospital engineering teams will assume commands and firmware updates could be forged, then trade throughput for certainty until they can prove otherwise. That means manual verification steps, deferred updates and slower dispatch. No attack is required to produce the delay.
The 2008 Parallel
In September 2008, short-term funding markets seized. The immediate cause was not that most counterparties were insolvent, since most were not. Lenders could no longer tell sound counterparties from unsound ones with the information available to them, so they stopped lending to nearly all of them. Institutions that could show clean, legible collateral kept their funding lines. Institutions that were probably fine, and could only say so, did not.
Q-Day works the same way, with cryptography standing in for collateral. The organisations that hold their relationships will be the ones that can show, on the day, what algorithms they use, where they use them and what replaces them. Assurance without evidence will perform about as well on Q-Day as it did in 2008.
What You Can Show on Day Zero
None of the following depends on knowing the date. Each item is worth having for its own sake, and each one becomes an answer to a question you will be asked under time pressure.
A cryptographic inventory. A cryptographic bill of materials, or CBOM, records which algorithms and key sizes appear in which systems, products and third-party components, with the key lifetimes attached. Most organisations discover during this exercise that the honest answer to “where do we use RSA” is longer than anyone expected.
Hybrid key exchange on external endpoints. Hybrid means running a classical exchange and a post-quantum one together, so the session stays protected if either holds. The post-quantum half is ML-KEM (previously Kyber), standardised as FIPS 203 in August 2024. Major browsers and content networks already negotiate it. Turning it on at your edge is a deployment task now, not a research project.
A signing roadmap with dates. Signatures take longer to migrate than key exchange, because firmware, hardware roots of trust and long-lived certificates all move on their own schedules. The standardised options are ML-DSA, formerly Dilithium, as FIPS 204, and the hash-based SLH-DSA as FIPS 205. What the board needs is the sequence and the dates, not a completed migration.
A retention map for harvest-now-decrypt-later. HNDL is the practice of capturing encrypted traffic today and decrypting it once the capability exists. The map is a short list of data classes that must stay confidential for another decade or more, matched against where that data travels today. Retention schedules and contractual confidentiality periods are already written down, so the exercise starts from documents you already hold rather than from a forecast.
A one-page statement, written in advance and approved. It says what you use, what you have replaced, what remains and by when. Legal, communications and the security function agree on it before it’s needed. The version drafted calmly in 2026 will be better than the version drafted at 6 a.m. on Q-Day.
The first of those artefacts is already a compliance obligation rather than a forecast. PCI DSS 4.0 requires a documented inventory of the cipher suites and protocols in use, reviewed at least once a year, so any organisation handling card data owes a version of the CBOM to an auditor before it owes one to a regulator asking about quantum.
Preparing the People Who Will Be Asked
The uncomfortable part of a confidence event is that the answers come from people, quickly, in front of an audience. A CBOM in a repository doesn’t help if the executive on the call can’t explain what a hybrid endpoint does, and a migration plan doesn’t reassure a regulator if nobody in the room can distinguish what has been demonstrated from what has been announced.
Quantum Academy’s post-quantum training addresses that gap. Teams working through the mechanics of a migration will also find the methodology at pqcframework.org useful alongside the training, and the deeper technical analysis behind these arguments sits at PostQuantum.com.
We can’t know the date. We do know the questions, and we know they arrive together. Start with Quantum Academy and be ready to answer them.